ZORP(8)

NAME
zorp - Zorp Firewall Suite

SYNOPSIS
zorp [options]

DESCRIPTION
Zorp is a new generation proxy firewall suite for Unix based operating systems. Zorp is object-oriented, component based, event controlled and modular. In the context of Zorp object-oriented means that both its configuration language and the underlying C code uses OOP techniques. Zorp uses glib, C structures and callbacks to mimic leightweight OOP in a non OOP language. Configuration uses Python, a nice & clean OOP language. component based means that the functionality provided by the C layer are broken into functionally independent components: Listener, Connector, Stream and Proxy. As connections are established, Python code takes care of connecting Streams and proxies in the way you desire. event controlled means that after a connection is established, proxies send events to Python, where decisions are made. The returning value controls how proxies communicate with their peers. modular means that given you have two streams (one to the client, and one to the server), you can use a proxy to connect those. E.g. if a proxy is able to send its subprotocol (POP3 in an SSH portforward channel) to a stream, and accept the changed protocol in another, you can attach another proxy to analyze the subprotocol. Since decisions are made by an interpreted language, any kind of access control can be implemented. This doesn't mean that you have to implement access control on your own. We provide ready made Python classes to implement a well tested and audited access control. Our aim is to implement the mandatory access control and discretionary access control described in CC LSPP (or TCSEC class B). Of course, nothing prevents you from rolling your own access control policy.

OPTIONS

--as <name> or -a
    Set instance name to <name>. Each log message is prefixed with this name.

--policy <name> or -p
    Use the file named <name> as policy. This file must contain valid Python code.

--verbose [num] or -v
    Set verbosity level to [num], or if [num] is omitted increment it by one. Default the verbosity level is 3, and possible values include 0-10.

--debug (obsolete) or -d
    Enable debug messages. This option is obsolete and doesn't do anything. Use --logspec instead.

--log-tags or -T
    Prepend log category and level to each message.

--log-spec <spec> or -s
    Set verbosity mask on a per category basis. Each log message has an assigned multi-level category, where levels are separated by a dot. For example HTTP requests are logged under http.request . spec is a comma separated list of log specifications. A single log specification consists of a wildcard matching log category, a colon, and a number specifying the verbosity level of that given category. Categories match from left to right. Example: --logspec 'http.*:5,core:3' The last matching entry will be used as the verbosity of the given category. If no match is found the default verbosity specified with --verbose is used.

--no-syslog or -l
    Instead of sending messages to syslog, write them to stdout.

--pidfile <name> or -P
    Write pid to the file named <name>.

--version or -V
    Display version a compilation information.

--threads <num> or -t
    Set the maximum number of threads that this Zorp instance may use concurrently.

--idle-threads <num> or -I
    Set the maximum number of idle threads.

--uid <uid> or -u
    Switch to the supplied uid after starting up.

--gid <gid> or -g
    Switch to the supplied gid after starting up.

--caps <caps> or -C
    Switch to the supplied set of capabilities after starting up. This should contain the required capabilities in the permitted set. For the syntax of capability description see the man page cap_from_text(3).

--no-caps or -N
    Do not change capabilities at all.

--chroot <dir> or -R
    Change root to specified directory before reading configuration file. The directory must be set up accordingly.

FILES
/etc/zorp/ /etc/zorp/policy.py /etc/zorp/instances.conf

AUTHOR
This manual page was written by Balázs Scheidler <bazsi@balabit.hu>.